inspection of small business administration's initial disaster ... oig...2 1 public l. no. 116-123 2...

S B A I N S P E C T O R G E N E R A L I N S P E C T I O N R E P O R T

INSPECTION OF SMALL BUSINESS ADMINISTRATION’S INITIAL DISASTER

ASSISTANCE RESPONSE TO THE CORONAVIRUS PANDEMIC

REPORT NUMBER 21-02 | October 28, 2020

EXECUTIVE SUMMARY

SMALL BUSINESS ADMINISTRATION’S INITIAL DISASTER ASSISTANCE RESPONSE TO THE CORONAVIRUS PANDEMIC

Report Number 21-02

October 28, 2020

What OIG Reviewed This report presents the results of our inspection to assess the Small Business Administration’s (SBA’s) initial disaster assistance response to the Coronavirus Disease 2019 (COVID-19) pandemic. SBA’s Disaster Assistance Program is the federal government’s primary program for providing disaster assistance. SBA provides Economic Injury Disaster Loans (EIDLs) of up to $2 million to eligible entities such as small businesses, nonprofits, farms, etc.

The Coronavirus Preparedness and Response Supplemental Appropriations Act deemed COVID-19 a disaster. The Act authorized SBA to provide EIDLs to eligible entities under the Small Business Act in geographic locations declared disaster areas. In addition, the Coronavirus Aid, Relief, and Economic Security Act provided $10 billion for a new vehicle—emergency advance grants. The Paycheck Protection Program and Healthcare Enhancement Act provided another $10 billion for the emergency advance grants and $50 billion in loan credit subsidy to support approximately $366 billion in additional disaster loans.

To meet our objective, we reviewed key provisions of the laws as well as SBA’s policies and procedures, and information on both SBA’s website and the loan application. Additionally, we analyzed loan data to determine if loans were provided to ineligible businesses and identify suspicious loan activity. Finally, we interviewed SBA and subcontractor personnel.

As of July 31, 2020, SBA had received over 14 million COVID-19 EIDL applications, of which it approved 3.2 million for a total of $169.3 billion. Additionally, SBA had disbursed 5.8 million emergency advance grants for $20 billion.

What OIG Found SBA’s initial response to implement the COVID-19 EIDL program made billions of dollars of capital available to provide prompt economic relief to businesses affected by COVID-19. To expedite the process, SBA “lowered the guardrails” or relaxed internal controls, which significantly increased the risk of program fraud. The unprecedented demand for COVID-19 EIDLs and the equally unprecedented challenges SBA had in responding to this pandemic

combined with lowered controls resulted in billions of dollars in potentially fraudulent loans and loans to potentially ineligible businesses.

Based on our analysis of SBA’s COVID-19 EIDL data, as of July 31, 2020, we found SBA approved $14.3 billion ($13.4 billion disbursed) in COVID-19 EIDLs to accounts that differed from the original bank accounts listed on the loan applications; $62.7 billion ($58.0 billion disbursed) in multiple (between 2 and 245) COVID-19 EIDLs to applicants using the same IP addresses, email addresses, bank accounts, or businesses listed at the same addresses; and approximately $1.1 billion in COVID-19 EIDLs and emergency advance grants to potentially ineligible businesses.

OIG Recommendations We made 10 recommendations for SBA to strengthen its controls to lower fraud risk and recover funds from ineligible businesses as it continues to respond to the ongoing pandemic.

Agency Response SBA Management disagreed with the audit findings we report here. Management only partially agreed with recommendations 1 through 8 and 10. Management disagreed with recommendation 9.

Overall management stated it disagreed with the findings because there was insufficient evidence that loans were approved and disbursed to ineligible businesses. It is important to note that despite management disagreeing with the findings and only partially agreeing with 9 of the recommendations, in most cases, the agency is taking corrective actions to fully implement our recommendations.

We have included management’s comments on this report in Appendix III.

Office of Inspector General U.S. Small Business Administration

Report Number 21-02

DATE: October 28, 2020

TO: Jovita Carranza Administrator

FROM: Hannibal “Mike” Ware Inspector General

SUBJECT: Small Business Administration’s Initial Disaster Assistance Response to the Coronavirus Pandemic

This report presents the results of our inspection of the Small Business Administration’s initial disaster assistance response to the coronavirus pandemic. We considered management’s comments on the draft of this report when preparing the final report. Management partially agreed with recommendations 1 through 8 and 10 and disagreed with recommendation 9.

If you have any questions please contact me or Andrea Deadwyler, Assistant Inspector General for Audits, at (202) 205-6586.

cc: William Manger, Chief of Staff and Associate Administrator, Office of Capital Access James Rivera, Associate Administrator, Disaster Assistance Christopher Gray, Deputy Chief of Staff

Brittany Biles, General Counsel Michael Simmons, Attorney Advisor, Office of General Counsel Rafaela Monchek, Director, Office of Continuous Operations and Risk Management Martin Conrey, Attorney Advisor, Legislation and Appropriations Tonia Butler, Director, Office of Internal Controls Tami Perriello, Chief Financial Officer and Policy Advisor to the Administrator

Table of Contents Introduction ............................................................................................................................................................................... 1

Figure 1. SBA COVID-19 EIDL Decisions as of July 31, 2020 ........................................................................ 2 Background ........................................................................................................................................................................... 2 Unprecedented COVID-19 EIDL Application Volumes ........................................................................................ 3 Loan Portal ............................................................................................................................................................................ 3

Table 1. Disaster Loan Portal Unscheduled Downtime, March 2020 ....................................................... 3 Table 2. SBA March 2020 COVID-19 EIDL Policy Decisions ......................................................................... 4

Volume Leads SBA to Outsource the Receiving and Processing of Applications to an Existing Contractor .............................................................................................................................................................................. 4

Figure 2. Number of Loan Applications Received by Subcontractor Number 2 as of July 31, 2020 ..................................................................................................................................................................................... 5

Additional Criteria Changes – Coronavirus Aid, Relief, and Economic Security Act ............................... 6 Table 3. CARES Act Changes to COVID Injury Loan ......................................................................................... 7 Eligibility and Repayment Requirements ............................................................................................................ 7 Requirements Before CARES Act ............................................................................................................................. 7 Requirements After CARES ACT .............................................................................................................................. 7

SBA and Subcontractor’s Processes for Recommending Approval or Decline of COVID-19 EIDLs . 8 Figure 3. Flowchart of the Major Steps in SBA’s and Subcontractor Number 2’s Process. ............. 9 April Policy Changes to Extend COVID Injury Loan Funds ........................................................................... 9

Paycheck Protection Program and Healthcare Enhancement Act ............................................................... 10 Funding Still Available as of July 31, 2020 ............................................................................................................. 10

Table 4. Status of COVID-19 EIDLs as of July 31, 2020 ................................................................................. 11 Timing of COVID-19 EIDLs and Advance Grants ................................................................................................. 11

Figure 4. Timing from Loan Application Receipt by Subcontractor to Funding ................................ 12 Figure 5. Grant Payment Timeframes as of July 31, 2020 ........................................................................... 13 Staffing .............................................................................................................................................................................. 13 Figure 6. Number Employees and Contractors in SBA Office of Disaster Assistance March 1-July 31, 2020 ........................................................................................................................................................................... 14 Figure 7. Calls Received by SBA’s Customer Service Center March 1-July 31, 2020. ....................... 14 Figure 8. Longest Call Wait Times by SBA’s Customer Service Center March 15-July 31, 2020. 15

Objective ............................................................................................................................................................................... 15 Results ................................................................................................................................................................................... 15

Finding 1: SBA Approved $14.3 Billion in Potentially Fraudulent Loans to Accounts that Differed from the Original Bank Accounts Listed on Applications ..................................................................................... 17

Recommendations ............................................................................................................................................................ 18

Finding 2: SBA Approved Billions of Dollars in Potentially Fraudulent Loans to Applicants Using Duplicate Information (IP Addresses, Email Addresses, Business Addresses, and Bank Accounts) .. 19

Figure 9. Overlap of Potentially Fraudulent Activity in EIDLs and Advance Grants ........................ 20 Multiple Loans to Applicants Using the Same IP Addresses ........................................................................... 20

Table 5. Sample of Top 10 IP Addresses Receiving Most Multiple Loans with Amounts as of July 31, 2020 ........................................................................................................................................................................... 20

Multiple Loans to Applicants Using the Same Email Addresses .................................................................... 21 Table 6. Sample of Top 10 Email Addresses Receiving Most Multiple Loans with Amounts as of July 31, 2020 .................................................................................................................................................................. 22

Multiple Loans to the Businesses with the Same Address on the Loan Application ............................. 22 Table 7. Sample of Top 10 Addresses Receiving the Most Multiple Loans and Amounts as of July 31, 2020 ........................................................................................................................................................................... 23

Multiple Loans to the Same Bank Accounts ........................................................................................................... 23 Table 8. Sample of Top 10 Bank Accounts Receiving the Most Multiple Loans as of July 31, 2020 ............................................................................................................................................................................................. 24 Table 9. Sample of Vague Borrower Names as of July 31, 2020 ............................................................... 27

Recommendations ............................................................................................................................................................ 28 Finding 3: SBA Approved Approximately $1.1 Billion in Loans and Advance Grants to Potentially Ineligible Entities ................................................................................................................................................................... 29

Recommendations ............................................................................................................................................................ 30 Analysis of Agency’s Response and Summary of Actions to Close the Report ............................................. 31

OIG Analysis of Agency’s Response ........................................................................................................................... 31 Summary of Actions to Close the Report ................................................................................................................ 33

Appendix 1: Objective, Scope, and Methodology ...................................................................................................... 38 Appendix 2: Summary of Prior OIG Reports Related to the SBA’s EIDL Disaster Assistance Response to COVID-19 ............................................................................................................................................................................. 40 Appendix 3: Management Comments ........................................................................................................................... 41

SBA RESPONSE TO INSPECTION REPORT ............................................................................................................. 41

1

Introduction

The Small Business Administration’s (SBA’s) Disaster Assistance Program is the federal government’s primary program for assisting small businesses, small agricultural cooperatives, and most private, nonprofit organizations after disasters. SBA provides up to $2 million in economic injury disaster loans (EIDLs) to help these eligible entities meet financial obligations and operating expenses.

In this report, we present the results of the Office of Inspector General’s (OIG’s) inspection to assess SBA’s initial disaster assistance response to the Coronavirus Disease 2019 (COVID-19) pandemic.

To provide prompt economic relief to businesses affected by the Coronavirus Disease 2019 (COVID-19) pandemic, SBA was tasked with lending more than $373 billion in COVID-19 EIDLs and $20 billion in COVID-19 emergency advance grants, which is more disaster loan funding than all the years combined since the agency was created in 1953.

The March 6, 2020, Coronavirus Preparedness and Response Supplemental Appropriations Act designated COVID-19 a disaster, which allowed SBA in accordance with the Small Business Act to provide EIDLs to affected eligible entities in declared disaster areas (See Figure 1).1 Additional laws passed in response to the COVID-19 pandemic and discussed in this report expanded the types of organizations that qualify as eligible entities and created a new emergency advance grant program (See pages 6 and 10).

Overall, eligible entities for COVID-19 EIDLs are defined as small businesses; small agricultural cooperatives; most private, nonprofit organizations; businesses, cooperatives, Employee Stock Ownership Plans, and tribal concerns with no more than 500 employees; sole proprietorships; independent contractors; and agricultural enterprises.2

1 Public L. No. 116-123 2 Agricultural enterprises means small business concerns engaged in the production of food and fiber, ranching and raising of livestock, aquaculture, and all other farming and agricultural-related industries, as defined by section 18(b) of the Small Business Act (15 U.S.C. 647(b)).

2

Figure 1. SBA COVID-19 EIDL Decisions as of July 31, 2020

Source: OIG analysis of SBA, congressional, and other events

Background

On March 12, 2020, the SBA Administrator issued a press release stating SBA was beginning to offer EIDLs of up to $2 million. On March 16, 2020, the first states (California, Connecticut, Maine, and Washington) were declared statewide COVID-19 disaster areas.3 By March 21, 2020, all states, the District of Columbia, and U.S. territories had been declared disaster areas. The declarations and COVID-19 being deemed a disaster allowed SBA to use about $1.1 billion in its disaster loan credit subsidy account to support $7 billion to $8 billion in EIDLs.4

SBA’s standard EIDLs are low interest loans (not to exceed 4 percent interest) to meet working capital requirements during the disaster-affected period until normal operations resume.5 The loan term is determined by the borrower’s ability to repay the loan but cannot be more than 30 years. SBA typically determines repayment ability using the business’s federal tax return and other income and expense information. The needs of the business and amount of economic injury determines the actual loan amount up to the legislative maximum amount of $2 million. SBA can set the maximum amount lower than $2 million.

For COVID-19 EIDLs, SBA lowered the maximum amount to $500,000 on March 16, 2020. That same day, SBA also set the minimum credit score for application approval.

Applicants can download an application or SBA will mail, email, or fax an application to them. The applicants can return the completed application by mail, email, or fax. This report refers to all faxed, emailed, and mailed applications as “mail-in applications.”

3 Federal Register, Vol 85, No. 69, Disaster Declarations of Economic Injury for the Coronavirus (COVID-19); Administrative Declarations of Economic Injury Disasters for the Entire United States and U.S. Territories, April 9, 2020. 4 The loan credit subsidy is the estimated long-term cost to the federal government of a direct loan or loan guarantee. The subsidy equals the net present value of estimated cash flows from SBA (for new disaster loans) minus the estimated cash flows to SBA (payments expected to be received over time on existing disaster loans), excluding administrative costs. 5 Disaster loan interest rates are set by federal statute and are based on the current Treasury funds rate.

3

Unprecedented COVID-19 EIDL Application Volumes

After SBA’s March 12, 2020, announcement, applicants quickly began applying for COVID-19 EIDLs by the tens of thousands. SBA suddenly had to handle unprecedented numbers of applications. For example, on March 31, 2020, more than 680,000 applications came in, the highest number of loan applications SBA has ever received on 1 day. By April 10, 2020, SBA had received more than 4.5 million loan applications, well above the average of 65,000 per year before the pandemic. By July 31, 2020, SBA had received over 14 million COVID-19 EIDL applications, in which it approved 3.2 million for $169.3 billion. Additionally, SBA disbursed 5.8 million emergency advance grants, totaling $20 billion.

To put this volume in perspective, an SBA official testified during a congressional hearing that since SBA was founded in 1953, SBA had approved 2.2 million disaster loans for $66.7 billion.6 SBA has now approved and disbursed more loans for COVID-19 relief than for all other disasters combined in the agency’s history.

To further emphasize the unprecedented volume, SBA approved the following multibillion-dollar loan volumes:

• Hurricanes Katrina, Rita, and Wilma—SBA approved 160,845 loans totaling $11 billion.

• Superstorm Sandy—SBA approved 38,094 loans totaling $2.6 billion.

• Hurricanes Harvey, Irma, and Maria—SBA approved 145,636 loans totaling $7.4 billion.

• Hurricanes Florence and Michael—SBA approved 25,991 loans totaling $1.16 billion.

Loan Portal

SBA’s Disaster Loan Application Portal did not have the capacity to handle the number of applicants seeking COVID-19 relief who logged in simultaneously. Consequently, the system was slow and periodically froze or crashed. The portal did not work at all for 30 or more minutes at least three times in March 2020, once for more than 6 hours (See Table 1).

Table 1. Disaster Loan Portal Unscheduled Downtime, March 2020

Date Portal Unscheduled Down Time (minutes) March 16, 2020 31

March 24, 2020 152

March 25, 2020 387 Source: SBA

SBA’s Office of Disaster Assistance issued a series of internal memorandums beginning on March 18, 2020, to attempt to streamline application processing for COVID-19 EIDLs (See Table 2).

6 U.S. House of Representatives, Small Business Committee, The Economic Injury Disaster Loan Program: Status Update from the Administration,116th Cong., 2d sess., July 1, 2020, https://youtu.be/qdxq-fZWh3c (accessed September 8, 2020).

https://youtu.be/qdxq-fZWh3c

4

Table 2. SBA March 2020 COVID-19 EIDL Policy Decisions

Eligibility and Repayment Requirements

Requirements for Standard SBA EIDLs

Requirements for COVID-19 EIDLS

Federal Tax Returns (Businesses and Agriculture Coops) Required Document Not Required

Federal Tax Returns (Nonprofits) Required Document Required Document

Open Bankruptcies Not Automatic Disapproval Not Automatic Disapproval

Credit Elsewhere Test Required Test Required Test

Minimum Credit Score Required Requireda

Delinquent Federal Debt Not Automatic Disapproval Not Automatic Disapproval

Title Search Required for Loans above $250,000 Required for

Loans of more than $500,000 Length of Loan Up to 30 years 30 years

Real Estate Collateral Preferred on loans Greater than $25,000 Not Required

Furniture, Fixtures, and Similar Collateral

Required for loans Greater than $25,000

Required for loans Greater than $25,000

Personal Guarantee Required for principals. Required for principals.

Hazard Insurance Proof before disbursementb Proof within 12 months Sources: March 18, 2020, Office of Disaster Assistance (ODA) Memo 20-17 Coronavirus Processing Changes; March 20, 2020, ODA Memo 20-18 Coronavirus Processing Changes Number 2; March 22, 2020, ODA Memo 20-19 Coronavirus Collateral and Insurance Changes a Before COVID-19 changes, a credit score above the minimum credit score meant the applicant was eligible from a credit standpoint but was still required to demonstrate repayment ability. After COVID-19, meeting the minimum credit score was considered as eligible both from a credit standpoint and repayment ability.

b This is only applicable to standard EIDLs that met the threshold requiring security. Unsecured loans did not require proof of hazard insurance.

Volume Leads SBA to Outsource the Receiving and Processing of Applications to an Existing Contractor

To increase the system’s capacity, SBA moved the application portal from its internal servers to the cloud, a network of servers that function using the Internet instead of local computers. But on March 25, 2020, system upgrading caused information on more than 7,900 applications to be potentially exposed to viewing by other applicants currently logged into the system. When the data exposure was discovered, SBA closed the application portal to COVID-19 EIDL applications. (The portal, Disaster Loan Application Portal 1.0, reopened for other disaster-related loan applications on April 3, 2020.)7

SBA turned to a contractor that had been hired on December 7, 2018, to streamline application processing through data analysis and loan underwriting. The contractor’s work was delayed by a bid protest, but the Government Accountability Office denied the protest on March 25, 2019,

7 In this report, we refer to the application portal for non-COVID-19 disaster loans as Disaster Loan Application Portal 1.0 and the separate portal for COVID-19 EIDLs as Disaster Loan Application Portal 2.0

5

allowing the contract to proceed. The contractor had done only limited work on disaster loans before the COVID-19 pandemic.

Because of the anticipated loan volume for COVID-19 EIDLs, SBA amended the original contract, increasing it from $100 million to $600 million on April 17, 2020, and again to $850 million on August 3, 2020. As of August 3, 2020, SBA had paid $485.8 million on this contract.

The new amended contract tasked the company with receiving applications for and underwriting COVID-19 EIDLs. The contractor delegated a portion of the non-COVID-19 disaster loan work (predominately loans to repair homes and personal property) to a subcontractor (subcontractor Number 1). However, subcontractor Number 1’s system was not suited well to process business loans like COVID-19 EIDLs, so it delegated that loan processing and advance grant tasks to its sister company, also as a subcontractor (subcontractor Number 2).

Subcontractor Number 1 continued to assist SBA in processing non-COVID disaster loans. Subcontractor Number 2 took over the reviewing process of COVID-19 EIDL applications, recommending either approval or denial of each application. SBA personnel reviewed the subcontractor’s loan recommendations, made the final decisions, and funded the loans.

From March 26 to March 28, 2020, a separate disaster loan application portal, Disaster Loan Application Portal 2.0, sent all new loan applications to an electronic “drop box,” or file storage service, where they were saved while the subcontractor set up its system. In total, 6,543 loan applications were sent to the drop box. SBA rerouted Disaster Loan Application Portal 2.0 so applications would go directly to subcontractor Number 2, which started receiving the applications on March 29, 2020, and began processing loans on April 6, 2020.

Based on subcontractor Number 2’s data, the subcontractor processed 33,542 applications on March 29, 2020. By July 31, 2020, subcontractor Number 2 had processed 14.1 million COVID-19 EIDL applications. Figure 2 shows the number of applications received by the subcontractor by day between March 29, 2020, and July 31, 2020.

Figure 2. Number of Loan Applications Received by Subcontractor Number 2 as of July 31, 2020

0

100000

200000

300000

400000

500000

600000

700000

800000

6

Source: OIG analysis of subcontractor data

Note: Disaster Loan Application Portal 2.0 was closed between April 15, 2020, and May 3, 2020, to all eligible entities because of a funding lapse. SBA reopened the portal between May 4, 2020, and June 14, 2020, to agricultural enterprises and reopened to all eligible entities on June 15, 2020 (See p. 11). The openings and closings of the portal represent the low application volume on certain days.

On March 25, 2020, the day the data exposure was discovered, SBA also stopped processing mail-in applications. Between March 25, 2020, and July 8, 2020, SBA received approximately 40,000 mail-in applications, or “hard copy” applications. SBA officials said the agency attempted to contact each applicant and persuade them to reapply through the Disaster Loan Application Portal 2.0, now redirected to subcontractor Number 2’s site. SBA officials said they do not know if all the mail-in applicants reapplied electronically.

Additional Criteria Changes – Coronavirus Aid, Relief, and Economic Security Act

On March 25, 2020, SBA lowered the required credit score for application approval. An SBA official said the change was due to “policy decisions” but did not give any further explanation.

On March 27, 2020, the President signed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which made significant changes to the COVID-19 EIDL requirements (See Table 3, changes in red).8 Most notably, the Act alleviated the requirements for tax returns and the credit elsewhere test.

Specifically, the Act said SBA could either approve an applicant based solely on credit score and not require a tax return or use an alternative method to determine repayment ability. These changes allowed SBA to approve an eligible applicant based on its credit score, as well as applicant self-certifications of the business’s start date, activity, annual gross revenues and cost of goods sold.9

8 Public L. No. 116-136, Sec. 1110 9 Public L. No. 116-136, Sec. 1110 (d)(1). All applicants for standard SBA EIDLs not associated with COVID-19 must demonstrate repayment ability and have acceptable credit scores to qualify.

7

Table 3. CARES Act Changes to COVID Injury Loan

Eligibility and Repayment Requirements

Requirements Before CARES Act

Requirements After CARES ACT

Federal Tax Returns (Businesses and Agriculture Coops) Not Required Not Required

Federal Tax Returns (Nonprofits) Required Document Not Required Open Bankruptcy Automatic Disapproval Automatic Disapproval Credit Elsewhere Test Required Test Not Required Credit Score Requireda Requireda

Delinquent Federal Debt Not Automatic Disapproval Not Automatic Disapproval

Title Search Required for Loans above $500,000 Required for Loans above

$500,000 Length of Loan 30 years 30 years Real Estate Collateral Not Required Not Required Furniture, Fixtures, and Similar Collateral

Required for Loans greater than$25,000

Required for Loans greater than$25,000

Personal Guarantee Required for principals. Required for principals. Hazard Insurance Proof within 12 months Proof within 12 months

Source: OIG analysis of the standard EIDL criteria and criteria in the CARES Act a Before COVID-19 changes, a credit score above the minimum credit score meant the applicant was eligible from a credit standpoint but was still required to demonstrate repayment ability. After COVID-19, meeting the minimum credit score was considered as eligible both from a credit standpoint and repayment ability.

The CARES Act also expanded COVID-19 EIDL eligible entities to include businesses, cooperatives, Employee Owned Stock Ownership Plans, and tribal concerns with not more than 500 employees; sole proprietorships with or without employees; and independent contractors affected by COVID-19.10 The Act set the period for COVID-19 EIDLs to be made between January 31, 2020, through December 31, 2020.11 The Act also mandated that only eligible entities in operation before February 1, 2020, would be eligible for loans.12

The CARES Act designated $10 billion for COVID-19 emergency advance grants.13 The Act allows eligible entities that have applied for a COVID-19 EIDL to request an advance grant of up to $10,000 and request SBA to pay out the funds within 3 days of receiving an application.14 The applicant is

10 Public L. No. 116-136, Sec. 1110(a)(2)-(b) 11 Public L. No. 116-136, Sec. 1110(a)(1) 12 Public L. No. 116-136, Sec. 1110(c)(2) 13 Public L. No. 116-136, Sec. 1110(e)(7). The CARES Act refers to the funds as COVID-19 emergency grants. In this report, we refer to the funds as advance grants in keeping with our recent Management Alert about fraud in the COVID-19 EIDL program, summarized here under “Prior Work.” 14 Public L. No. 116-136, Sec. 1110(e)(3) & Public L. No. 116-136, Sec. 1110(e)(1)

8

not required to repay any of the advance grant, even if later denied a COVID-19 EIDL.15 SBA decided to limit advances to $1,000 per employee for up to 10 employees.16

SBA and Subcontractor’s Processes for Recommending Approval or Decline of COVID-19 EIDLs

It is important to note that subcontractor Number 2’s system electronically checks the application; each application is not reviewed by the subcontractor’s personnel. Subcontractor Number 2’s system uses public domain information and certain fraud indicators in accessing and verifying loan application information.

The subcontractor’s system verification check of the bank accounts is contingent on each bank’s Customer Identification Program and the amount of customer information collected as required under 31 C.F.R. § 1020.220. The subcontractor estimates that 40 percent of banks do not collect enough information for its system to verify a bank account.

We were told the system makes these checks before the credit check to determine loan eligibility based on application information. The main reasons the system would deem an application ineligible are insufficient economic injury, ineligible business type, or ineligible answers to other application questions, such as felony convictions, etc.

Figure 3 shows SBA’s and subcontractor Number 2’s process for approving or declining COVID-19 EIDL applications for both the loans and advance grants.

15 Public L. No. 116-136, Sec. 1110(e)(5) 16 SBA Internal Memorandum, Authorization for Payments from [Contractor], April 7, 2020. The total disbursement amount for each record included in the payment file is calculated based on the following logic: 1) if number of employees is 0 then $1,000, 2) if number of employees is greater than 10 then amount is $10,000, or 3) otherwise amount is number of employees times $1,000.

9

Figure 3. Flowchart of the Major Steps in SBA’s and Subcontractor Number 2’s Process.

Source: SBA subcontractor Number 2

After subcontractor Number 2’s system determines eligibility of the loan application, it sends the loan application to SBA with a recommendation to approve or decline and flags the record with any concerns. Between late March 2020 and early April 2020, SBA set policies for the SBA loan officers and team leads to follow for processing COVID-19 EIDL applications.

In addition to the 40,000 mail-in applicants that SBA contacted to reapply, the agency set up automatic “robocalls” to contact more than 90,000 applicants whose unprocessed applications had been received by SBA before closing Disaster Loan Application Portal 1.0 to COVID-19 applications. SBA also contacted the 6,543 applicants whose unprocessed applications were received in the drop box site during the portal outage. Both were encouraged to reapply using the Disaster Loan Application Portal 2.0. If those applicants did not reapply, they did not receive an advance grant.

SBA required reapplication to ensure the applications went directly to subcontractor Number 2’s processing system. SBA’s message told the applicant that the new application would be used for both the COVID-19 EIDL and the advance grant. SBA also mailed notices to the applicants to notify them of the requirement to reapply. Unlike the mail-in applications (hard copy applications), SBA officials said they maintained these applicants’ places in line according to the receipt date of their previous unprocessed digital application.

April Policy Changes to Extend COVID Injury Loan Funds

In March 2020, SBA had between $7 billion and $8 billion available for COVID-19 EIDLs and non-COVID disaster loans. It set the COVID-19 EIDL maximum at $500,000. But the huge number of loan applications quickly depleted the funds. Consequently, the agency lowered the maximum COVID-19

10

EIDL amount to $15,000 on April 3, 2020, stating this change was made to help as many businesses as possible.

However, a week later on April 11, 2020, SBA restored the maximum amount of a COVID-19 EIDL to $500,000 and the minimum required credit score back to the original. According to an SBA official, the changes were “policy decisions.” The official did not give any additional explanation.

On April 15, 2020, SBA closed the Disaster Loan Application Portal 2.0 to new applications. The agency had received approximately 5.5 million applications, but officials did not know how much funding would be appropriated in Congress’s next relief act. The next day, April 16, 2020, SBA determined it had obligated all disaster funds up to that point.

Paycheck Protection Program and Healthcare Enhancement Act

The President signed the Paycheck Protection Program and Healthcare Enhancement Act on April 24, 2020.17 This Act appropriated an additional $10 billion for advance grants and an additional $50 billion to SBA’s disaster loan credit subsidy account to support approximately $366 billion in additional loans.18

On May 3, 2020, SBA made the decision to cut the COVID-19 EIDL maximum from $500,000 to $150,000. The Act also expanded eligible entities to include agricultural enterprises.19 The next day, May 4, 2020, SBA reopened its Disaster Loan Application Portal 2.0 only for agricultural business applications.

Funding Still Available as of July 31, 2020

As of June 11, 2020, SBA reported it had disbursed approximately $10.7 billion in advance grants. SBA had approximately $9.3 billion in advance grant funding remaining available. By July 14, 2020, SBA had awarded the entire $20 billion in advance grants. SBA also reported in mid-June that it had approved approximately $91 billion of $373 billion in COVID-19 EIDLs. On June 15, 2020, SBA reopened its Disaster Loan Application Portal 2.0 to all eligible entities.

On July 10, 2020, SBA officials said the agency had approximately 280,000 approved loans yet to be disbursed. SBA officials said some of the undisbursed loans were awaiting borrower action, such as signing loan documents. In some other cases, there were errors in the borrower’s application, such as incorrect bank routing numbers for direct deposit delaying disbursement. SBA decided that these loans will be deobligated after 90 days of borrower inaction or the agency is unable to contact the borrower.

We analyzed the number of COVID-19 EIDLs recorded in SBA’s Capital Access Financial System. As of July 31, 2020, there were more than 345,000 approved loans totaling approximately $13.8 billion to be disbursed (See Table 4). The agency still had approximately $204 billion of $373 billion ($373 billion minus the $169 billion disbursed or obligated) to lend for disaster loans as of July 30, 2020.

17 Public L. No. 116-139 18 Public L. No. 116-139, Div. A Sec. 101(b) and Title II “Disaster Loans Programs Account”

19 Public L. No. 116-139, Div. A Sec. 101(c)

11

Table 4. Status of COVID-19 EIDLs as of July 31, 2020

Loan Statusa Number Dollar Amount ($)

Disbursed Current 2,778,328 $155,406,147,663 Active Undisbursed 345,465 13,750,708,775 Paid in Full 5,473 164,585,700 In Liquidation Disbursed 51 6,810,000 Fully Cancelled 38,909 0 Total 3,168,226b $169,328,252,138

Source: OIG analysis of SBA’s Capital Access Finance System a Disbursed Current means the loan has been disbursed to the borrower. Active Undisbursed means the loan has been approved and obligated but has yet to be disbursed to the borrower. Paid in Full means the loan was disbursed to the borrower but the borrower or their bank returned the funds. In Liquidation Disbursed means the loan was disbursed to the borrower and then the borrower went into bankruptcy or died. Fully Cancelled generally means the loan was approved but the applicant decided not to accept the loan, or the applicant did not accept the loan in time. Applicants must accept loans within 90 days of approval. b This includes 298 loans in the Capital Access Financial System (117 Cancelled and 181 Active Undisbursed) that we could not tie back to an application in subcontractor Number 2’s system, the SBA’s application system, or the SBA’s data warehouse. We should have been able to find the 298 loan applications because the data is exported from the subcontractor’s system to the Capital Access Financial System.

Timing of COVID-19 EIDLs and Advance Grants

SBA took an average of 49 days to receive, underwrite, and fund loan applications for 2,783,755 COVID-19 EIDLs disbursed as of July 31, 2020. In some cases, the process took up to 124 days to fund loan applications, but some were funded on the same day the application was received (see Figure 4).20 Figure 4 shows the number of loans approved and disbursed by number of days after the application was received. For example, 134,492 loans were funded 68 days after the application was received (as shown by the red bar in Figure 4).

20 The 345,465 active undisbursed loans shown in Table 4 are not reflected in average loan processing calculation or the data used for Figure 4. Once these loans are disbursed, the average number of days to process loans could increase.

12

Figure 4. Timing from Loan Application Receipt by Subcontractor to Funding

Source: OIG analysis of subcontractor data

Although the data shows 58,459 EIDLs were funded on the same day as the application was received, we are concerned about the accuracy of this data, because before funding, SBA personnel must review the application, and obtain signed documents from the borrowers.

We also compared the date loan applications were recorded in subcontractor Number 2’s system to the date of grant disbursement. From the beginning of the program through July 31, 2020, SBA took between 0 days (same day) and 106 days (average of 22 days) to pay out advance grant funds (See Figure 5). We found SBA paid 1,325,695 grants within 3 days.

Figure 5 shows the number of advance grants approved by number of days after the application was received. For example, 446,700 advance grants were funded 24 days after the application was received (as shown by the red bar in Figure 5).

0

20,000

40,000

60,000

80,000

100,000

120,000

140,000

160,000

0 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60 64 68 72 76 80 84 88 92 96 100

104

108

112

116

120

124

Nu

mbe

r of L

oans

Number of Days

13

Figure 5. Grant Payment Timeframes as of July 31, 2020

Source: OIG analysis of subcontractor’s data

Staffing

On February 28, 2020, SBA’s Office of Disaster Assistance had 3,483 employees and contractors. In March 2020, the office began the process to increase its staff size to 10,000 employees and contractors for SBA’s initial response to the pandemic and to continue to respond to other disasters (See Figure 6). By July 31, 2020, the office had more than 9,000 employees and contractors. In comparison, the highest ever staffing levels previously in SBA’s Office of Disaster Assistance was just over 5,000 employees working on SBA’s disaster response to Hurricanes Harvey, Irma, and Maria in 2017.

1

100,001

200,001

300,001

400,001

500,001

0 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60 64 68 72 76 80 84 88 92 96 100104

Num

ber o

f Loa

ns

Number of Days

14

Figure 6. Number Employees and Contractors in SBA Office of Disaster Assistance March 1-July 31, 2020

Source: SBA

From March 1, 2020, to July 31, 2020, SBA’s Customer Service Center received 10.9 million calls (See Figure 7). Between July 31, 2020, and August 10, 2020, SBA’s Customer Service Center received almost 700,000 additional calls. SBA data shows 18 percent of callers gave up while waiting on hold.

Figure 7. Calls Received by SBA’s Customer Service Center March 1-July 31, 2020.

Source: SBA

The overall average call wait time was 14 minutes. But the daily maximum time callers were on hold between March 15, 2020, and July 31, 2020, ranged from 34 seconds to 4 hours and 10

3,478 3,737

6,833

8,072

9,111

0

1,000

2,000

3,000

4,000

5,000

6,000

7,000

8,000

9,000

10,000

3/27/2020 4/24/2020 5/29/2020 6/26/2020 7/31/2020

Num

ber o

f Em

ploy

ees a

nd

Cont

ract

ors

121,969 132,918 127,755406,646 642,803412,089

532,932 352,789

442,363438,224

0

1,396,0111,154,095

1,899,551

2,836,582

0

500,000

1,000,000

1,500,000

2,000,000

2,500,000

3,000,000

3,500,000

4,000,000

March April May June July

Num

ber o

f Cal

ls

Other Calls COVID-19 Non-EIDL Calls COVID-19 EIDL Calls

15

minutes (See Figure 8).21 SBA also received 2.1 million emails about all COVID-19 loans and more than 300,000 of these emails had not been answered as of July 31, 2020.

Figure 8. Longest Call Wait Times by SBA’s Customer Service Center March 15-July 31, 2020.

Source: SBA

Objective

Our objective was to assess SBA’s initial disaster assistance response to the COVID-19 pandemic, including staffing adequacy, loan application volume, timeliness of disaster loan approval, and customer service.

Results

SBA’s initial response to implement the EIDL program made billions of dollars of capital available to provide prompt economic relief to eligible entities affected by the COVID-19 pandemic. However, the unprecedented demand for COVID-19 EIDLs and equally unprecedented challenges SBA had in responding resulted in billions of dollars being distributed to potentially ineligible entities or fraudsters because of errors, weaknesses in controls, and fraud. We found several strong fraud indicators in alignment with what we have uncovered in ongoing criminal investigations demonstrating that SBA approved:

• approximately $14.3 billion (disbursed $13.4 billion) in potentially fraudulent loans to accounts that differed from the original bank accounts listed on applications;

21 System issues limited the calculation of wait time for two of the days.

0:00:00

0:28:48

0:57:36

1:26:24

1:55:12

2:24:00

2:52:48

3:21:36

3:50:24

4:19:12

4:48:00

2/19/2020 3/10/2020 3/30/2020 4/19/2020 5/9/2020 5/29/2020 6/18/2020 7/8/2020 7/28/2020 8/17/2020

Tota

l Tim

e Ca

lls W

ere

On

Hold

16

• approximately $62.7 billion (disbursed 58.0 billion) in potentially fraudulent loans to applicants using the same IP address, the same email address, the same bank accounts, or businesses listed at the same addresses; and

• approximately $1.1 billion in disaster loan funds to potentially ineligible businesses that registered an Employer Identification Number after the cutoff date of January 31, 2020, which could indicate they were not in business by this deadline, as required.

17

Finding 1: SBA Approved $14.3 Billion in Potentially Fraudulent Loans to Accounts that Differed from the Original Bank Accounts Listed on Applications

We found that as of July 31, 2020, SBA had approved 281,414 COVID-19 EIDLs totaling $14.3 billion ($13.4 billion of which has been disbursed) to applicants who later changed the bank account number to pay out the loan to a different number than that listed on the original loan application. For these applications, an additional $13.6 million was disbursed in advance grants.22

We compared all bank account numbers on loan applications in subcontractor Number 2’s database to all the bank account numbers for loans in SBA’s Capital Access Financial System. We found 281,414 differences between the bank account number on the application and the number recorded in Capital Access Financial System.

In some cases, the applicant made mistakes when completing the application. For example, an applicant put the bank’s routing number in the bank account information field or vice versa. Another example is transposed numbers in the bank account or routing number or not including all the digits for those numbers. In such cases, SBA staff generally contacted the applicant if they could not verify the account number, and the applicant provided the correct information.

However, other scenarios we found are highly suspicious and strong indicators of potential fraud. Suspicious examples include bank account numbers being significantly different or routing numbers of entirely different banks than the account numbers on the original application. It is also suspicious when the change is to an online-only debit card financial institution instead of a checking account at the brick-and-mortar banking institution listed on the original application.

For example, SBA received 22 loan applications from the same Internet Protocol, or IP address, the identifying number associated with a specific computer or computer network. The applications claimed to represent 22 individual farms located in 6 states. Although 13 of the 22 applications were originally submitted with unique bank accounts, they were submitted from the same IP address with nearly identical financial data and approved by SBA. Before the loans were disbursed, the bank account numbers were changed to three separate banks with new routing numbers and account numbers, none of which were associated with the bank listed on the application. SBA disbursed $1.9 million dollars to those accounts.

In another specific example, three loan applications were submitted with three unique bank accounts. After approval but before disbursement, all three applications bank accounts were changed to a debit card financial institution. Two of the loans were disbursed for $30,300 and the third loan was approved for $9,300 but had not been disbursed as of July 31, 2020.

An official at SBA’s Subcontractor Number 2 said loan applicants can change the bank account information at any point in the process. We found this concerning. Essentially, an applicant can use anyone’s legitimate bank account number to get their application through the controls in the subcontractor’s system, which includes a verification of the bank account information. Then having

22 For the approved loan amount, we used the Net Gross Amount from SBA’s loan data, which is the original approved loan amount minus any reduction in the approved amount or cancellation of the approved loans.

18

bypassed the controls, the applicant can later change the account number post-system controls and before the loan is funded, which greatly increases the risk of undetected fraud.

On August 10, 2020, shortly after we briefed the Administrator on this alarming issue, SBA worked with the subcontractor to fix the problem. An official at the subcontractor company said in mid-August 2020, the system controls were changed to require the bank account information to be revalidated whenever the loan applicant changes the bank account information.

Loans to potentially ineligible borrowers reduce the amount of available critical capital needed for eligible businesses to withstand the effects of the pandemic and increase the risk of financial loss. These loans also constitute improper payments under the Payment Integrity Information Act of 2019.23 The Improper Payments Act defines improper payments to include payments made to ineligible recipients.24 SBA should flag these loans for its FY 2021 Improper Payments estimation process.

Recommendations

We recommend the Administrator to direct the Associate Administrator for Disaster Assistance to:

1. Review all loans that had a bank account number changed from that shown on the original application to determine if the changes were legitimate or fraudulent. If not legitimate, work to recover the funds, deobligate any undisbursed funds, and refer to the OIG.

2. Establish or strengthen controls to ensure loan deposits are made to legitimate bank accounts for eligible borrowers only.

23 Public L. No. 116-117, codified at 31 U.S.C. §§3351 - 3358 24 31 U.S.C. §3351(4)

19

Finding 2: SBA Approved Billions of Dollars in Potentially Fraudulent Loans to Applicants Using Duplicate Information (IP Addresses, Email Addresses, Business Addresses, and Bank Accounts)

We found that as of July 31, 2020, SBA had approved more than one loan to applicants that used the same IP addresses, email addresses, business addresses, or bank accounts. Although there may be some legitimate reasons for individual occurrences, multiple occurrences indicate a strong probability of fraud. Specifically, SBA:

• approved 977,086 potentially fraudulent COVID-19 EIDLs totaling $62.7 billion, of which $58 billion had been disbursed, to applicants using the same IP addresses (an additional $614.8 million was disbursed in advance grants);

• approved 319,936 potentially fraudulent COVID-19 EIDLs for $26.7 billion, of which $25.4 billion has been disbursed, to applicants using the same email addresses (an additional $172.2 million was disbursed in advance grants);

• approved 260,109 potentially fraudulent COVID-19 EIDLs totaling $15.4 billion, of which $14.5 billion had been disbursed, to businesses listed at the same address (street, city, and the zone improvement plan, or ZIP code) on their applications (an additional $134.9 million was disbursed in advance grants); and

• approved 16,015 potentially fraudulent COVID-19 EIDLs for $928.1 million, of which $811.5 million had been disbursed, to the same bank accounts (an additional $2.5 million was disbursed in advance grants).25

It is important to note that there is overlap among these four subgroups of all the approved COVID-19 EIDLs as of July 31, 2020 (See Figure 9). The overlap amongst the subgroups indicates a higher likelihood of fraud.

We recognize that some of the loans in these subgroups could be legitimate and for eligible businesses. An example would be an accounting or law firm filling out multiple applications for their clients. However, SBA’s control should have been to thoroughly research these applications containing duplicative information before approval. Additionally, when the information indicated suspicious activity, SBA should have requested additional supporting documentation from the applicants to sufficiently alleviate any fraud concerns. SBA should thoroughly research these suspicious situations in current loans to determine whether the loans are legitimate, and the businesses are eligible for COVID-19 EIDLs.

The following subsections describe what we found in each subgroup. We compiled a “top 10” list for each to show that many IP addresses, email addresses, physical addresses, and bank accounts were approved for more than 2 loans (and up to 245 loans). We also provide specific examples of suspicious loan activity, which is in line with the fraudulent loan activity schemes we have uncovered in our ongoing investigations.

25 For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved loan amount minus any reduction in the approved amount or cancellation of approved loans.

20

Figure 9. Overlap of Potentially Fraudulent Activity in EIDLs and Advance Grants

Source: OIG Analysis of SBA’s COVID-19 EIDLs in SBA’s Capital Access Financial System

Multiple Loans to Applicants Using the Same IP Addresses

Our analysis of the top 10 IP addresses used by applicants to submit and obtain approval for multiple loans showed that 245 loans were approved for $14.4 million for IP address Number 1 (See Table 5).

Table 5. Sample of Top 10 IP Addresses Receiving Most Multiple Loans with Amounts as of July 31, 2020

BORROWER IP ADDRESS

COUNT OF

LOANS APPROVED

AMOUNT($)a DISBURSED AMOUNT($)

IP Address Number 1 245 $14,458,800 $14,211,500 IP Address Number 2 174 26,693,800 26,329,600 IP Address Number 3 173 14,481,400 14,342,200 IP Address Number 4 168 16,263,700 15,469,000 IP Address Number 5 152 12,868,600 12,511,300 IP Address Number 6 137 11,046,400 10,754,500 IP Address Number 7 133 12,967,600 12,803,000 IP Address Number 8 124 11,821,000 11,012,700 IP Address Number 9 121 9,030,200 8,430,100 IP Address Number 10 114 3,966,300 3,816,300

Source: OIG Analysis of subcontractor’s data a For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved loan amount minus any reduction in the approved amount or cancellation of approved loans.

We analyzed loan and application data from the subcontractor’s system. Overall, we found 280,520 IP addresses used by applicants to submit multiple applications. SBA approved more than one loan to each of those applicants.

$62.7 Billion in Loans and $614.8 Million in Grants toApplicants at the Same IP

Addresses

$15.4 Billion in Loans and

$134.9 Million in Grants to

Businesses at the Same Addresses

$928.1 million in Loans and $2.5 Million in Grants to the Same Bank Accounts

$26.7 Billion in Loans and

$172.2 Million in Grants toApplicants at

the Same Email

Addresses

21

For example, applicant(s) at one IP address and using primarily what looks like an email address at a fish market with six locations in one state applied for 85 COVID-19 EIDLs loans (SBA approved 84) in various company names of jewelry stores, psychiatric services, construction, gas stations, and other non-seafood businesses. SBA disbursed $9,383,600 to these potentially fraudulent companies.

The three following examples raise similar red flags. Note, the applications could have been made by more than one individual. The key is that all were submitted from the same IP address.

• An applicant at one IP address applied for and SBA approved 10 COVID-19 EIDLs for different farms. However, some of the addresses for the farms were residential homes or apartments. This applicant also used an email address with periods that could be moved within the same address to create several different addresses; for example, john.smith@ and jo.hn.smith@. This technique is another indicator that these are potentially fraudulent loan applications. SBA disbursed $506,700 for these potentially fraudulent farms.

• An applicant at one IP address submitted 25 applications claiming to represent 21 unique farms and businesses located across 6 states. Between August 1, 2020, and September 14, 2020, another 3 applications were submitted from this IP address. In total, SBA approved 15 of the applications and disbursed 14 of them for $1,715,100. In between application submission and disbursement, the applicant changed several of the bank accounts. Additionally, these applicants used similar email addresses.

• An applicant at one IP address submitted 62 applications claiming to represent 62 unique farms and businesses located across 22 states. Between August 1, 2020, and September 14, 2020, another 68 applications were submitted from this IP address. In total, SBA approved 13 of the applications and disbursed 8 of them for $349,500. In between application submission and disbursement, the applicant changed several of the bank accounts. This applicant also moved the period around in the different email addresses used in the applications.

Multiple Loans to Applicants Using the Same Email Addresses

Our analysis of the top 10 email addresses used by applicants to apply for and obtain approval of multiple loans, showed one example of 158 loans approved for $9.4 million using the same email address. (See Table 6)

22

Table 6. Sample of Top 10 Email Addresses Receiving Most Multiple Loans with Amounts as of July 31, 2020

BORROWER EMAIL ADDRESS

COUNT OF

LOANS APPROVED

AMOUNT($)a DISBURSED AMOUNT($)

Email Address Number 1 158 $9,434,600 $8,696,900 Email Address Number 2 156 14,352,600 13,323,300 Email Address Number 3 120 9,623,100 9,332,600 Email Address Number 4 104 7,582,100 7,548,400 Email Address Number 5 102 9,161,600 8,987,200 Email Address Number 6 94 8,696,700 8,479,200 Email Address Number 7 90 9,060,900 8,481,600 Email Address Number 8 86 4,344,600 2,642,100 Email Address Number 9 83 5,374,700 5,315,900 Email Address Number 10 83 4,225,500 4,113,500

Source: OIG Analysis of subcontractor’s data aFor the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved loan amount minus any reduction in the approved amount or cancellation of approved loans.

We analyzed loan data for multiple COVID-19 EIDLs to the same email addresses in SBA’s Capital Access Financial System. Overall, we found 113,324 email addresses that SBA had approved more than one loan to applicants that used those email addresses on their applications.

Some of this loan data indicates suspicious activity. For example, applicant(s) at one email address applied for 10 COVID-19 EIDLs and SBA approved eight loans in various company names (names of family members, restaurant, hostel, roofing company, karate organization, and other businesses). SBA disbursed $807,100 to these potentially fraudulent companies.

In another example, an applicant(s) at one email address applied for 10 COVID-19 EIDLs and SBA approved 10 loans for 10 different bathroom renovation businesses in the same city. However, we were not able to locate any bathroom renovation companies in that company’s name in that city. Additionally, the email address indicates it is for a burrito restaurant, which we did locate in that city. SBA disbursed $1.4 million for these potentially fraudulent companies.

Multiple Loans to the Businesses with the Same Address on the Loan Application

Our analysis of the top 10 addresses used by applicants to submit and obtain approval for multiple loans showed that the top address was used for 97 loans. The total loan disbursement was approximately $1.4 million (See Table 7). We also found that for some of the applications the business names were the same and for some the business names differed.

23

Table 7. Sample of Top 10 Addresses Receiving the Most Multiple Loans and Amounts as of July 31, 2020

Borrower Address Number of

Loans Approved

Amount ($)a Disbursed

Amount ($) Address Number 1 97 $1,497,200 $1,377,800

Address Number 2 75 1,377,400 1,272,900 Address Number 3 57 2,472,000 2,472,000 Address Number 4 51 1,184,600 1,184,600 Address Number 5 48 2,002,600 1,713,900 Address Number 6 47 1,631,100 1,608,100 Address Number 7 44 569,900 569,900 Address Number 8 41 1,400,000 1,400,000 Address Number 9 40 973,100 973,100 Address Number 10 37 2,442,500 2,293,500

Source: SBA Capital Access Financial System a For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved loan amount minus any reduction in the approved amount or cancellation of approved loans.

We analyzed loan data for multiple COVID-19 EIDLs to the same address in SBA’s Capital Access Financial System. Overall, we found 110,549 business addresses (street, city, and ZIP code) for which SBA approved more than 1 loan for businesses at those locations.

Using basic Internet searches, we determined some of the addresses listed are locations of registered agent services or locations such as large office buildings that could potentially house multiple businesses. However, our searches revealed that some of the multiple loans were made to residential addresses, pharmacies, and a vacant lot.

It seems fraudsters understood that sending a shower of applications increased the likelihood that one or more would make it through existing controls. For example, one applicant filled out 38 applications, and subcontractor Number 2’s system flagged these loan applications as potential fraud or duplicates. But some of the applications were reviewed by different loan officers, and at least two of the loans were approved and disbursed for a total of $384,600.

In another example, 10 COVID-19 EIDL applications were submitted and approved using the same house address and received $1,136,200. Also, 11 COVID-19 EIDL applications were submitted and approved using the same apartment address and received $658,300.

Multiple Loans to the Same Bank Accounts

We analyzed loan data from SBA’s Capital Access Financial System for multiple loans to the same bank accounts. In total, we found 7,282 applicants received more than one loan in their bank account. (See Table 8 for a sample of the top 10 bank accounts used by applicants to submit and obtain approval for multiple loans). We also found half of the applicants for these 7,282 loans applied for multiple loans using the same IP addresses.

24

Table 8. Sample of Top 10 Bank Accounts Receiving the Most Multiple Loans as of July 31, 2020

Bank Account Number of

Loans Approved

Amount ($)a Disbursed Amount($)

Bank Account Number 1 38 $4,977,600 $4,977,600

Bank Account Number 2 28 1,898,900 1,898,900

Bank Account Number 3 22 532,100 532,100







Bank Account Number 10 14 722,100 169,400 Source: SBA’s Capital Access Financial System a For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved loan amount minus any reduction in the approved amount or cancellation of approved loans.

For example, 13 different types of businesses (financial, automotive, gymnastics, etc.) received loans for $1,167,800 to the same bank account. It is possible these are legitimate different types of business run out of one bank account. However, it is suspicious behavior and should be researched by SBA to determine if these are legitimate businesses.

SBA Policy Changes. To get funds to eligible entities quickly, SBA “lowered the guardrails” by removing or weakening of controls. For example, SBA reduced existing controls by abandoning the rule of two reviewers for each loan application, setting high production goals, approving loans in batches without review, and ignoring system flags. We have found through thousands of contacts from banks and hotline complaints and our own data analytics that these actions increased fraud risk significantly.

Several factors attributed to the potential fraudulent duplicate loans, as follows:

SBA Abandoned the Rule of Two. In a more typical situation, SBA would require the “Rule of Two,” meaning at least two SBA personnel would have to approve a loan. However, SBA did not do this for COVID-19 EIDLs. SBA officials told us that the subcontractor sent clean loan applications recommended for approval in batches of 25 to 50 loans. An SBA team lead would approve these batches with little to no vetting of the loan information.

Applications are considered clean if the subcontractor’s system does not find any major problems, such as large number of applications with other lenders, owner information failed validation, digital identity fraud suspicion, invalid bank account number, or bank account number does not match business. However, these loans considered by the subcontractor’s system as clean and included in batches could have multiple minor issues, such as client location is international, phone number is not associated with the business, large number of applications in succession, email does not pass validation, or unable to confirm business registration.

25

An SBA official told us they considered the subcontractor’s system as the first review and the SBA team lead as the second review. This approach, however, does not satisfy the Rule of Two because some of the system identified loan application issues were ignored (such as large number of applications in succession), and some system controls were only sometimes effective (such as the bank account could only be verified 60 percent of the time). SBA employees could potentially see trends in fraudulent applications that a system potentially could not identify, especially if a system is not programmed to detect a change such as bank account changes or if the system’s capability is limited, such as not flagging all duplicative loans as discussed below.

Timing Goals for Loan Decisions. Office of Disaster Assistance officials established production goals that loan officers should make final loan decisions (approval or denial) on at least 4 loan applications per hour, and team leads should make final loan decisions (approval or denial) on 10 to 12 loan applications per hour. To meet that goal, the officers had to make their decisions within an average of 15 minutes and team leads within an average of 5 to 6 minutes per application despite the complexity and serious nature of the responsibility entrusted to the loan officers and team leads. SBA’s production requirement resulted in cursory reviews rather than the deeper reviews required to ensure loans were given to eligible businesses.

After our briefing on August 10, 2020, SBA issued a new policy that day curtailing approval of loan applications in batches.26 This change should help reduce the number of potential fraudulent loans previously being approved in batches without being properly vetted by SBA personnel.

SBA Ignored Subcontractor’s System Flags. We found the subcontractor’s system identified multiple potentially fraudulent applications with duplicate names, account numbers, addresses, or other information. However, SBA personnel did not always adequately address the flags before approving the loans. SBA officials took corrective action after we warned them of the issue. Along with the other policy changes on August 10, 2020, SBA issued a new informal policy requiring all subcontractor flags on loan applications must be researched and fully resolved before approving or denying a loan or the application will be returned to the loan officer.27 Team leads are required to add notes to the files telling loan officers what actions to take and what to tell applicants. Loan officers also are required to document the actions taken to resolve the flags.28

SBA also set a new procedure requiring loan officers to manually check the applicant’s Social Security Number and federal Taxpayer Identification Number before processing each duplicate loan application. These changes should help reduce approvals of potential fraudulent loans that have duplicate information because they should be properly vetted by SBA personnel.

26 SBA Email to Disaster Assistance Processing and Disbursement personnel, [Subcontractor] Procedure Update Number 2, August 10, 2020 27 SBA Email to Disaster Assistance Processing and Disbursement personnel, [Subcontractor] Procedure Update Number 2, August 10, 2020 28 SBA Email to Disaster Assistance Processing and Disbursement personnel, [Subcontractor] Procedure Update Number 2, August 10, 2020

26

Subcontractor’s System Control Did Not Always Flag Duplicative Loans. On August 12, 2020, SBA discovered controls in the subcontractor’s system were not always consistently flagging problematic loan applications.29 The system did not link related loan applications when multiple loan applications had the same information. These features help to prevent fraud and are also essential in preventing multiple loan decisions to the same entity. This inoperable control could have led to some loan applications being mistakenly marked “clean” and erroneously approved in batches. A subcontractor official told us the duplicate-logic system control was corrected in mid-August.

SBA Action to Address our July 2020 Management Alert on Duplicate Loans. In our July 2020 Management Alert, we warned SBA that we had found approximately $45.6 million in duplicate loans to the same businesses at the same addresses.30 The findings in this report are a continuation of that analysis as we further identified the scope of the potential fraud.

In response to our Management Alert, SBA issued a notice to financial institutions to alert them to the potential for suspicious activity related to COVID-19 EIDL funds deposited into business or personal bank accounts.31 The notice included some examples of suspicious activity, such as use of stolen identities, EINs, or Social Security Numbers to qualify for the COVID-19 EIDLs and advance grants. The notice also explained how to report suspicious banking activity to SBA.

As we continued our analysis post-Management Alert, we found more duplicate loans. We briefed the Administrator on August 10, 2020, about these potentially fraudulent loans. Shortly afterwards, SBA informally implemented and strengthened some of its controls to address vulnerabilities.

In addition to the other corrective actions SBA took on August 10, 2020, SBA also established a new informal policy requiring loan officers to automatically decline any loan applications flagged by the subcontractor for the following reasons:

• Suspicious online activity, device associated with fraud, high-risk IP addresses, or client is international;

• Related deals by bank accounts that are not the same business or person;

• Email addresses and phone numbers in somebody else’s name; and

• Email addresses with periods that can be moved around (such as “[email protected]”).32

All such applications, including legitimate applications, if appealed by the borrower will be sent to the loan application reconsideration process, which will require the applicant to provide more supporting documentation.

29 SBA Email to Disaster Assistance Processing and Disbursement personnel, Duplicate and Related Logic, August 12, 2020 30 SBA OIG 20-16, Serious Concerns of Potential Fraud in EIDL Program Pertaining to the Response to COVID-19 (July 28, 2020). 31 SBA Informational Notice, Guidance Regarding Identification and Reporting of Suspicious Activity in the COVID-19 EIDL Loan Program, July 22, 2020. 32 SBA Email to Disaster Assistance Processing and Disbursement Personnel, [Subcontractor] Procedure Update Number 1, August 10, 2020

27

EIDL Data was Inaccurate and Incomplete. On August 20, 2020, we told SBA and subcontractor officials that we have observed approved loans where the borrower’s name is blank, “same,” “NA,” “not applicable,” or “not available,” in SBA Capital Access Financial System. We asked the subcontractor how the system would identify and flag duplicate loans with these borrower names. A subcontractor official claimed that the data in its system is accurate and this might be a problem with the accuracy of the digital feed from subcontractor Number 2’s system to SBA’s Capital Access Financial System.

We also explained that we have seen loan files with vague borrower names such as “Uber,” “Lyft,” and“AirBNB,”as well as files in which the name field contains the borrower’s address, year of birth, or other errors (See Table 9).

Table 9. Sample of Vague Borrower Names as of July 31, 2020

Borrower Namea Number of

Loans Uber 1,148

Lyft 362

N/A 342

None 162

uber 160

UBER 148

Uber Driver 126

Independent Contractor 128

Uber driver 126

Uber Technologies 119

Doordash 117

Self employed 116

Instacart 109

NA 106

Self Employed 104 Source: OIG analysis of SBA Capital Access Financial System a The borrower name field is case sensitive.

We asked how the system could verify the accuracy of information and identify potential fraud with such unspecific data. Subcontractor and SBA officials were surprised by this issue and said they would research it.

Additionally, we found 249,432 approved loans and 136 disbursed loans without any bank account information. It is concerning these applications were approved without banking information and based on the data, we are unable to determine where the loans were deposited.

Such inaccuracies in data will present challenges for SBA in servicing loans. SBA officials said the agency has hired a major accounting firm to help fix data issues but did not explain exactly what the firm is doing to accomplish the task. We do not know if the accounting firm is addressing this issue or some other issue.

28

SBA should strengthen their controls further to lower fraud risk to an acceptable level. Without better controls, loans to potentially ineligible borrowers reduce the amount of available critical capital needed for eligible businesses to withstand the effects of the pandemic and increase the risk of financial loss.

SBA should flag all loans deemed ineligible for its FY 2021 improper payments estimation process.

Recommendations


3. Review duplicate loans to IP addresses, email addresses, business addresses, and bank accounts to determine if there are undisbursed funds that should be suspended until the duplicate loans are assessed for eligibility.

4. Cancel all ineligible loans that are not disbursed, recover funds from all loans disbursed to ineligible applicants, and flag those loans for the improper payments estimation process.

5. Strengthen or establish controls to ensure multiple loans are provided only to eligible applicants and prevent the erroneous duplication of loans.

6. Strengthen data integrity to make it possible to determine if the inaccurate information allowed loans to be made to ineligible entities and to strengthen SBA’s ability to service loans appropriately.

29

Finding 3: SBA Approved Approximately $1.1 Billion in Loans and Advance Grants to Potentially Ineligible Entities

We found that SBA approved 22,706 COVID-19 EIDLs totaling $917.7 million and 45,385 advance grants totaling $135.1 million to potentially ineligible entities. In our July 2020 Management Alert, we warned SBA that we had found approximately $250 million in approved loans to ineligible entities. This finding is a continuation of that analysis.

The CARES Act requires that applicants had to be in business on January 31, 2020, to be eligible for COVID-19 EIDLs or advance grants.33 To determine if applicants were in business on January 31, 2020, we cross-referenced a database of Employer Identification Number (EIN) registrations made between February 1,2020, and July 31, 2020, and matched them to data in SBA’s subcontractor Number 2’s database as of August 5, 2020. We removed all sole proprietorships, because these businesses could have been in operation for some time and be eligible for a COVID-19 EIDL even though the EIN was registered after January 31, 2020

Of these applications, SBA approved 22,706 COVID-19 EIDLs totaling $917.7 million and 45,385 advance grants totaling $135.1 million to applicants with EIN registration dates of February 1, 2020, or later. In total, SBA approved nearly $1.1 billion to potentially ineligible applicants.

We believe this occurred because SBA did not require applicants to validate EIN registration dates. Instead, SBA relied on the applicant to self-certify the “Date Business Established.” Applicants who certified their entity existed before February 1, 2020, were then evaluated by a loan officer or team lead. Loan officers or team leads searched the Internet to determine if a webpage indicated the entity was in operation before February 1. If the loan officer or team lead found evidence, the application was approved. If the loan officer or team lead did not find evidence, the processor attempted to contact the applicant for evidence that the entity existed before February 1, 2020.

We believe an Internet search is not sufficient to determine business eligibility, because websites can be fabricated to support the application. SBA should fully verify whether these entities were legitimately in business on or before January 31, 2020, by using a government resource (state or federal), and if they were not, SBA should recover the loan funds.

During this inspection, we also found that ineligible entities (such as “adult industry” businesses) received COVID-19 EIDLs. In addition, SBA received fraudulent applications for prominent national leaders that were obviously not legitimate applications and in one case paid the $5,000 advance grant before denying the loan.

We also have received hotline complaints about identities being stolen and used for fraudulent applications. For example, SBA received fraudulent loan applications in the name of a prominent real estate developer, a major shoe manufacturer, and one of its own SBA District Office Directors. SBA appropriately denied the loan for the real estate developer. However, SBA approved and funded the fraudulent loan for the shoe manufacturer in the amount of $150,000. The agency also approved but did not disburse the loan for its District Director because the director informed SBA of the identity theft. SBA also terminated several employees for approving loans to themselves.

33 Public L. No. 116-136, Sec. 1110(c)

30

On August 14, 2020, SBA established a new policy, which stated if the subcontractor’s system was unable to determine business eligibility through a public records search, loan officers should attempt to verify the business eligibility through an Internet search. If the loan officer is unable to locate a legitimate online presence for the business (not a website that looks like it was just created for the purposes of obtaining a loan), the loan application should be declined.

Loans to potentially ineligible borrowers reduce the amount of available critical capital needed for eligible businesses to withstand the effects of the pandemic and increase the risk of financial loss. These loans also constitute improper payments under the Payment Integrity Information Act of 2019.34 SBA should flag these loans for its FY 2021 improper payments estimation process.

Recommendations


7. Review the applicants with approved loans to determine if there are undisbursed funds remaining that should be suspended until the business start date is verified and the applicant is deemed eligible based on the CARES Act eligibility requirements. If the applicant is deemed ineligible, recover any disbursed funds, deobligate any undisbursed funds, and flag the application as ineligible.

8. Review the advance grants to determine if the application was legitimate and the business met CARES Act eligibility requirements. If not, recover the funds and flag the application as ineligible.

9. Revise the FY 2021 Improper Payments Act Checklist to include checking EIN dates for COVID-19 EIDLs and advance grants or program the system to flag erroneously approved loans and advance grants as improper payments; the information should be used during the FY 2021 improper payments estimation process.

10. Strengthen controls for verifying an entity’s start date to ensure applicants meet eligibility requirements.

34 31 U.S.C. §3351(4)

31

Analysis of Agency’s Response and Summary of Actions to Close the Report

SBA management provided formal comments to the draft report. We have included those comments in Appendix III. SBA management requested, and we agreed not to include the final appendix of their response because it included confidential information such as corporate or individual identities associated with IP addresses, business addresses, email addresses, and bank accounts. Management disagreed with all the findings, partially agreed with recommendations 1 through 8 and 10, and disagreed with recommendation 9. We considered management’s comments when preparing this final report.

OIG Analysis of Agency’s Response

SBA management’s comments assert that we do not provide enough evidence to prove that loans were provided to ineligible businesses or potentially fraudulent entities, and that our analyses are flawed. We strongly disagree. SBA attempts to diminish this review’s findings that point to internal control weaknesses that our investigative results have confirmed.

OIG agrees that there are valid loans within the loan portfolio where there is little or no assurance of fraud prevention or of eligibility; however, such examples provide a scant retort in context of the billions of taxpayer dollars at stake. Notwithstanding, we recognize the significance of better understanding and accounting for such instances in context of the internal control condition. Unfortunately, SBA officials did not provide most of the information presented in their response at any point during the inspection process. While it would have been helpful to have this information, none of the information presented in SBA’s response alters our findings.

SBA’s management continues to insist that its controls are robust despite overwhelming evidence to the contrary. Our analysis of SBA’s COVID-19 EIDL loan and application data highlights strong indicators of ongoing fraudulent activity in the COVID-19 EIDL Program. These indicators are backed by the following facts, which are strong indications that fraud has occurred on a large scale and continues to worsen:

• OIG’s Investigation Division and other law enforcement agencies have already seized over $450 million from more than 15,000 fraudulent COVID-19 EIDLs. OIG and other law enforcement partners continue to seize additional fraudulent loan funds stemming from the risk areas identified in this report.

• OIG’s Investigations Division and other law enforcement organizations have more than 5,000 loans under investigation, and new investigations are being initiated daily using the risk profiles identified in this report.

In addition to criminal investigation, other government offices are seeking to assist the victims of this fraud. For example, the Federal Trade Commission indicates it received 223,995 reports involving fraud, identity theft, and other concerns associated with the nation’s pandemic response as of October 14, 2020. SBA management is aware that numerous individuals’ identities were stolen and used to embezzle or attempt to embezzle federal funds. Often when OIG finds one loan or grant based on a stolen identity, we find numerous other applications, loans, or grants used by the same IP address, email address, business address, or bank account.

32

At the same time FTC was reporting a spike in complaints, OIG was receiving an unprecedented number of complaints to its Hotline. By August 31, 2020, we had received a total of more than 42,000 hotline complaints. As of September 30, 2020, this total had increased to more than 77,000 hotline complaints. Hundreds of complaints continue to come in daily.

• Financial institutions across the country have contacted OIG about thousands of loans that they believe to be suspicious because the deposits were made to account holders claimi

inspection of small business administration's initial disaster ... oig...2 1 public l. no. 116-123 2...

Documents